# Explainability Guided Adversarial Evasion Attacks on Malware Detectors

**Authors:** Kshitiz Aryal, Maanak Gupta, Mahmoud Abdelsalam, Moustafa Saleh  
**arXiv:** [2405.01728](https://arxiv.org/abs/2405.01728)  
**Date:** 2024-05-02  
**Summary page:** https://www.summarizepaper.com/en/paper/2405.01728v1/

## Key points

- Crafting optimal adversarial perturbations is crucial for enhancing AI system security in the malware domain
- Explainability techniques are applied to improve adversarial evasion attacks on a machine-learning-based Windows PE malware detector
- Significant regions of PE malware files that influence the detector's decision-making process are identified and leveraged for injecting adversarial perturbations strategically
- Profiling all regions of PE malware files based on their impact on the detector's decision-making process and considering their significance and sensitivity towards modification is part of the approach
- The DeepExplainer module of SHAP is used to determine each region's contribution to detection by a CNN-based malware detector, MalConv
- Subdividing Windows PE sections into smaller subsections based on SHAP values of byte sequences leads to increased evasion success rates when selecting subsections with higher aggregated SHAP values within the same sections
- Leveraging explainability in machine learning-based malware detectors can enhance the creation of evasive adversarial PE malware samples and improve AI security against malicious attacks

## Summary

The importance of crafting optimal adversarial perturbations for enhancing the security of Artificial Intelligence (AI) systems has become increasingly crucial in the malware domain. This study focuses on applying explainability techniques to improve adversarial evasion attacks on a machine-learning-based Windows PE malware detector. By utilizing an explainable tool, significant regions of PE malware files that influence the decision-making process of the detector are identified and leveraged to strategically inject adversarial perturbations for maximum efficiency. The approach involves profiling all regions of PE malware files based on their impact on the detector's decision-making process and considering both their significance and sensitivity towards modification. To assess the effectiveness of explainable AI in crafting adversarial samples, the DeepExplainer module of SHAP is used to determine each region's contribution to detection by a CNN-based malware detector, MalConv. A granular analysis is also conducted by subdividing Windows PE sections into smaller subsections and performing adversarial evasion attacks based on corresponding SHAP values of byte sequences. The results show that selecting subsections with higher aggregated SHAP values within the same sections leads to a significant increase in evasion success rates compared to those with lower aggregate SHAP values. In conclusion, this study highlights how leveraging explainability in machine learning-based malware detectors can enhance the creation of evasive adversarial PE malware samples and emphasizes the importance of advanced techniques and tools like CNN-based MalConv and SHAP in developing effective strategies for improving AI security against malicious attacks.